CVE-2023-2024

CRITICAL

Improper Authentication for OpenBlue Enterprise Manager Data Collector

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-2024 has a selected CVSS score of 10.0 (critical); EIP currently links 6 repository PoCs.

Description

Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
6

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 21, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

OpenBlue Enterprise Manager Data Collector

Browse Johnson Controls / OpenBlue Enterprise Manager Data Collector

Default status: unaffected

CVE ListBefore 3.2.5.75affected

Proofs of concept

6

Repository PoCs

GitHubactuator/yiRepository PoCby actuator1Not analyzed3 files

2.2 MiB · linked to 3 vulnerabilities

GitHub
PoC details
GitHubteam890/CVE-2023-2024Repository PoCby team8901Not analyzed75 files

3.7 MiB · linked to 2 vulnerabilities

GitHub
PoC details
GitHubduy-31/CVE-2023-46805_CVE-2024-21887Repository PoCby duy-3123Not analyzed3 files

3.2 KiB · linked to 4 vulnerabilities

GitHub
PoC details
GitHubraminkarimkhani1996/CVE-2023-46805_CVE-2024-21887Repository PoCby raminkarimkhani19965Not analyzed3 files

73.6 KiB · linked to 4 vulnerabilities

GitHub
PoC details
GitHubseajaysec/Ivanti-Connect-Around-ScanRepository PoCby seajaysec12Not analyzed5 files

24.9 KiB · linked to 4 vulnerabilities

GitHub
PoC details
GitHubW01fh4cker/CVE-2024-27198-RCERepository PoCby W01fh4cker157Not analyzed2 files

22.7 KiB · linked to 3 vulnerabilities

GitHub
PoC details

References

3